Protocol hack
It is not the code that is at fault but who holds the keys
What can happen
Almost every protocol has places with special rights. Somebody has to be able to set parameters, replace contracts or stop things in an emergency.
Those rights hang on keys. And keys hang on people, machines and procedures - that is, on everything that cannot be checked in code.
| The key is obtained | By deceiving an employee, by malware on their device, through a compromised service provider. |
|---|---|
| The interface is altered | What is attacked is not the contract but the page people operate it through. It shows an ordinary operation and initiates a different one. |
| A service provider is attacked | Protocols use third-party components. Whoever controls one of them reaches everyone who embeds it. |
How that turns into a financial loss
Whoever holds the administrative rights need not look for a flaw. They are allowed anyway.
Depending on the protocol, such rights allow funds to be withdrawn, parameters to be shifted so that positions become liquidatable, or contracts to be swapped for others. For the blockchain that is not an attack but a permitted action - carried out by an address entitled to do it.
The loss hits the depositors, without their having done anything wrong and without the code being faulty.
A documented case
DOCUMENTED CASEBybit and Safe{Wallet}, February 2025
The case shows what is peculiar to this group of incidents: the signatures were valid, the signatories authorised, the contract flawless. What had been altered was what the signatories got to see.
Can this be the subject of a cover?
In principle yes, but the boundary is more delicate than with smart contract risk.
Because here the question is where the attack took place. In the protocol? At the operator? At a service provider? With the person who approved it? Wordings cut along that line, and the cases often lie exactly on it.
What the wording has to answer
| Are administrative rights covered? | Or does the wording cover only flaws in the code? Misuse of legitimate rights is not a code flaw. |
|---|---|
| Does an attack on the operator count? | Many products cover the protocol, not the company behind it. |
| Does a service provider count? | If the loss arises through an embedded third-party component - is that still the same event? |
| What if the approval was lawful? | Where there was deception rather than breach, an exclusion often applies. Look for that line first. |
| Who bears the burden of proof? | With a code flaw the sequence is onchain. With an obtained key much of it lies outside. |
| From when does it count as having occurred? | With the outflow, with the operator’s determination, or with a report? |
Terms used here
-
The distinction most wordings cut along.
-
Why a valid signature does not mean the right thing was signed.
-
Who has special rights in a protocol in the first place.